Lucene search

K
githubGitHub Advisory DatabaseGHSA-7XPV-4PM9-XCH2
HistoryJun 02, 2023 - 7:41 p.m.

mx-chain-go does not treat invalid transaction with wrong username correctly

2023-06-0219:41:31
CWE-20
GitHub Advisory Database
github.com
8
metachain
transaction processor
cross-shard
miniblock
multiversx chain
notarization
patched binary

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.5%

Impact

Metachain cannot process a cross-shard miniblock.
An invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version.

Patches

Introduce processIfTxErrorCrossShard for metachain transaction processor.

Workarounds

No

References

No

Affected configurations

Vulners
Node
multiversxmx-chain-goRange<1.4.16

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.5%

Related for GHSA-7XPV-4PM9-XCH2